Computer system and access control method

1. A computer system, comprising: at least one computer including a memory and a plurality of CPU cores; and a storage sub device including a plurality of logical storage units constituted by a storage device, wherein in the computer: a plurality of queues are configured in the memory; each of the plurality of queues is assigned at least one of the plurality of CPU cores; and to each of the plurality of queues, an I/O command dispatched from a CPU core assigned to each of the plurality of queues to a logical storage unit is to be enqueued, and the computer system includes an access controller that determines whether to accept or refuse access from each of the plurality of queues to each logical storage unit.

2. The computer system according to claim 1 , further including queue group information for managing the plurality of queues configured in the computer as a group, wherein whether to accept or refuse access to each logical storage unit with respect to each of the plurality of queues belonging to one group in the queue group information is collectively changed to a same configuration.

3. The computer system according to claim 2 , wherein the computer is a virtual computer running on a physical computer, the memory and the plurality of CPU cores are, respectively, a virtual memory and a virtual CPU core included in the virtual computer, the physical computer and the storage sub device are coupled by a Non-Volatile Memory Express (NVMe)-compliant interface, the storage sub device is configured to determine whether to accept or refuse access by the I/O command enqueued to each of the plurality of queues to a logical storage unit based on the access controller, and a queue management mechanism executed by the physical computer or a prescribed management computer manages the queue group information.

4. The computer system according to claim 3 , wherein the virtual computer is configured to transmit a queue assignment request command including a number of requested queues that is determined based on a number of virtual CPU cores to the queue management mechanism, and the queue management mechanism is configured to determine a number of queues to be assigned to the virtual computer based on the number of requested queues included in the queue assignment request command received from the virtual computer, and transmit to the storage sub device a queue group creation command for creating a group to which the determined number of queues belongs.

5. The computer system according to claim 4 , wherein the queue management mechanism is configured to transmit to the storage sub device an access configuration command for collectively changing whether to accept or refuse access related to the plurality of queues belonging to one group in the queue group information to a same configuration.

6. The computer system according to claim 4 , wherein the queue management mechanism is configured to display a number of I/O commands, for which access refusal is determined, among I/O commands enqueued to a queue of the plurality of queues belonging to a certain group in association with a virtual computer in which the queue belonging to the queue group is configured.

7. The computer system according to claim 2 , wherein the computer is a virtual computer running on a physical computer, the memory and the plurality of CPU cores are, respectively, a virtual memory and a virtual CPU core included in the virtual computer, the computer system further comprises an adapter apparatus for coupling the physical computer to the storage sub device, the physical computer and the adapter apparatus are coupled by a Non-Volatile Memory Express (NVMe)-compliant interface, the adapter apparatus is configured to determine whether to accept or refuse access by the I/O command enqueued to each of the plurality of queues to a logical storage unit based on the access controller, and a queue management mechanism executed by the adapter apparatus manages the queue group information.

8. The computer system according to claim 7 , wherein the adapter apparatus is configured not to transmit the I/O command to the storage sub device when a determination result of whether to accept or refuse access is access refusal.

9. The computer system according to claim 2 , wherein the access controller includes access control information that is a bitmap constituted by a plurality of queue IDs and a plurality of logical storage unit IDs, and a bit specified by one queue ID and one logical storage unit ID indicates whether to accept or refuse access from the specified queue ID to the specified logical storage unit ID.

10. The computer system according to claim 9 , wherein the queue group information is a bitmap constituted by a plurality of group IDs and a plurality of queue IDs, and a bit string specified by one group ID indicates a queue ID belonging to the group ID.

11. The computer system according to claim 10 , wherein collectively changing whether to accept or refuse access from the plurality of queues IDs belonging to a group ID to each logical storage unit ID to a same configuration refers to acquiring a bit string of a queue ID corresponding to the group ID that is a configuration change target from the queue group information and collectively replacing bit strings in the access control information by using the acquired bit string of the queue ID, the logical storage unit ID that is the configuration change target, and a bit after the configuration change.

12. An access control method, wherein in at least one computer including a memory and a plurality of CPU cores, a plurality of queues are configured in the memory, and each of the plurality of queues is assigned at least one of the plurality of CPU cores, the method comprising, when an I/O command dispatched from a CPU core assigned to a queue to a logical storage unit is enqueued to the queue, determining whether to accept or refuse access by the I/O command to each logical storage unit is determined based on an access controller that determines whether to accept or refuse access from each queue to each logical storage unit.